I've been having lots of fun (genuinely - not being sarcastic) writing bash scripts to automate and protect the VNC server.
I have a single script which is run at startup that runs everything else. It first attempts to kill any previous versions of the processes it's about to start, then starts them. It starts x11vnc, websockify and my protection script.
My protection script, every 5 seconds, checks to see if everything is intact and running correctly.
1) It checks if the LAN connection is enabled. If it's not, it activates it and resets the default gateway to that of our main router. The reason for this is I discovered (with great *facedesk*) that if you disable eth0 you lose vnc access.
2) It checks if a specific file exists in the main shared 8TB drive. If the file exists, it runs the emergency script which kills everything and restarts the vnc with known-good settings. The reason for this is if I'm experimenting with various x11vnc settings and get one wrong, it fails to start and I lose vnc access.
3) It checks if either x11vnc or websockify are running. If either one is not, it runs the startup script again which kills everything and starts again. The reason for this is obvious: If I accidentally close either x11vnc or websockify I lose vnc access.
--
The point of going to such extents with the scripts is to remove the need for a keyboard, mouse and monitor on the NAS. I never want to have to carry an armful of cords and screen into the office just to fix the NAS. In a worst-case scenario where I've made a mistake in one of my scripts, I want to simply be able to make sure no one is using the NAS drive via their Windows PCs, then hit the reset button on the NAS. It'll restart and everything will reset.
If you're interested, here are my scripts
We have two ISPs - very fast high-bandwidth but very laggy satellite (for downloading large files overnight), moderately fast low-bandwidth but responsive tethered 3G (for browsing/MP games) - hence the gateway-switching scripts.
nas.sh
#!/bin/bash
pkill -f "xterm -e /home/[user]/Desktop/vncsafeguard.sh"
pkill -f "/bin/bash /home/[user]/Desktop/vncsafeguard.sh"
pkill -f "xterm -e x11vnc"
pkill -f "xterm -e websockify"
sleep 1
xterm -e x11vnc -shared -forever -nowireframe -nopw -xdamage -xdamage -repeat -display :0 &
xterm -e websockify 6900 localhost:5900 &
nohup ~/Desktop/vncsafeguard.sh &>/dev/null &
echo "Ignore this window - it will disappear shortly"
sleep 5
vncsafeguard.sh
#!/bin/bash
echo "VNC safeguard running"
echo "If this window is visible, the safeguard is in debug mode"
echo "Don't press ctrl+c or you'll kill the safeguard!"
while :
do
sleep 5
[ $(cat /sys/class/net/eth0/operstate) == "down" ] &> /dev/null && (echo [password] | sudo -S ifconfig eth0 up) && ~/Desktop/toskymesh.sh
[ -f "/mnt/drive/nas.reset" ] &> /dev/null && (~/Desktop/safereset.sh)
pgrep -f "xterm -e x11vnc" &>/dev/null || (~/Desktop/nas.sh)
pgrep -f "xterm -e websockify" &>/dev/null || (~/Desktop/nas.sh)
done
safereset.sh
#!/bin/bash
pkill -f "xterm -e /home/[user]/Desktop/vncsafeguard.sh"
pkill -f "/bin/bash /home/[user]/Desktop/vncsafeguard.sh"
pkill -f "xterm -e x11vnc"
pkill -f "xterm -e websockify"
pkill -f "nas.sh"
sleep 2
echo [password] | sudo -S route del default
echo [password] | sudo -S route add default gw 192.168.0.11 eth0
echo [password] | sudo -S ifconfig eth0 up
xterm -e x11vnc -shared -forever -nopw -display :0 &
xterm -e websockify 6900 localhost:5900 &
rm -f /mnt/drive/nas.reset
xterm -e ~/Desktop/saferesetalert.sh
saferesetalert.sh
#!/bin/bash
green='\e[0;32m'
nc='\e[0m' #nc stands for no colour
echo
echo
echo "########################################################"
echo
echo -e "${green}Emergency backup VNC access${nc} has been activated"
echo "The file nas.reset has been removed"
echo
echo "This window will close automatically in 60 seconds but"
echo "can also be safely closed manually"
echo
echo "########################################################"
echo
echo
sleep 60
toskymesh.sh
#!/bin/bash
echo [password] | sudo -S route del default
echo [password] | sudo -S route add default gw 192.168.0.11 eth0
tooptus.sh
#!/bin/bash
echo [password] | sudo -S route del default
echo [password] | sudo -S route add default gw 192.168.0.10 eth0
Revolver Ocelot
